VAR-201108-0236
Vulnerability from variot - Updated: 2026-03-09 21:41The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895. The problem is CVE-2006-1168 and CVE-2011-2895 May be related toA third party could be put into an infinite loop and execute arbitrary code through a crafted compressed stream. GIMP is prone to a buffer-overflow vulnerability Successfully exploiting this issue may allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. The software enables a variety of image manipulations, including photo retouching, image compositing, and image creation. Gimp's "LZWReadByte()" function (plug-ins/common/file-gif-load.c) has a buffer overflow vulnerability when processing GIF graphics.
The updated packages have been patched to correct these issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2896
Updated Packages:
Mandriva Linux 2010.1: 6765f41707b43b717ddb8dd3bfa4cdbc 2010.1/i586/gimp-2.6.8-3.2mdv2010.2.i586.rpm 4c1aab6b423ab88f2fa0bb507a7c60bf 2010.1/i586/gimp-python-2.6.8-3.2mdv2010.2.i586.rpm 7fd3284b7bc8696ae8075f1a7349c732 2010.1/i586/libgimp2.0_0-2.6.8-3.2mdv2010.2.i586.rpm a61333781b8723af9f45dbb94ce9bbb9 2010.1/i586/libgimp2.0-devel-2.6.8-3.2mdv2010.2.i586.rpm f4a4c0635712389d3a438818c3bbde7c 2010.1/SRPMS/gimp-2.6.8-3.2mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64: d2ed9cb97e27c8ae7a718b904d442cd1 2010.1/x86_64/gimp-2.6.8-3.2mdv2010.2.x86_64.rpm a60fb4df9340ce11a17f8b3c0011c2ac 2010.1/x86_64/gimp-python-2.6.8-3.2mdv2010.2.x86_64.rpm 55a40dfc4c289c48a0971c4fbb01d395 2010.1/x86_64/lib64gimp2.0_0-2.6.8-3.2mdv2010.2.x86_64.rpm dd6d1abb065aa27644b369061f666b0c 2010.1/x86_64/lib64gimp2.0-devel-2.6.8-3.2mdv2010.2.x86_64.rpm f4a4c0635712389d3a438818c3bbde7c 2010.1/SRPMS/gimp-2.6.8-3.2mdv2010.2.src.rpm
Mandriva Linux 2011: 40025c9fcafb3d02bd37c92b940c353d 2011/i586/gimp-2.6.11-7.1-mdv2011.0.i586.rpm 5a3226c6ecdbbae83b90ed9e28c6941a 2011/i586/gimp-python-2.6.11-7.1-mdv2011.0.i586.rpm 9f156b65a74d0b74538f50b441cc37c4 2011/i586/libgimp2.0_0-2.6.11-7.1-mdv2011.0.i586.rpm af0d3a7478773243aa76d99f148b5186 2011/i586/libgimp2.0-devel-2.6.11-7.1-mdv2011.0.i586.rpm 4b4024953d52232e1cf0f308dc3a16dc 2011/SRPMS/gimp-2.6.11-7.1.src.rpm
Mandriva Linux 2011/X86_64: f8f0140aebd1666c5d10b09f57de20cc 2011/x86_64/gimp-2.6.11-7.1-mdv2011.0.x86_64.rpm d27e9d2ef098ad86d3f68adf1c5f49ca 2011/x86_64/gimp-python-2.6.11-7.1-mdv2011.0.x86_64.rpm da1fa7693e5cd7dd8d9807912a61161a 2011/x86_64/lib64gimp2.0_0-2.6.11-7.1-mdv2011.0.x86_64.rpm 453e8a82d6e7425a7a5e2758a5e6879d 2011/x86_64/lib64gimp2.0-devel-2.6.11-7.1-mdv2011.0.x86_64.rpm 4b4024953d52232e1cf0f308dc3a16dc 2011/SRPMS/gimp-2.6.11-7.1.src.rpm
Mandriva Enterprise Server 5: 5ca4859d1aab6879d30e6b2188f38d4a mes5/i586/gimp-2.4.7-1.4mdvmes5.2.i586.rpm b6baebc7a47430b09816c43fee81370f mes5/i586/gimp-python-2.4.7-1.4mdvmes5.2.i586.rpm b22ac83c1f8d96d5919aaabe1af9aada mes5/i586/libgimp2.0_0-2.4.7-1.4mdvmes5.2.i586.rpm 73b245e8d872bfabaa20787c454e175b mes5/i586/libgimp2.0-devel-2.4.7-1.4mdvmes5.2.i586.rpm 2bc33101108e4bcddd0ccdf6a927958d mes5/SRPMS/gimp-2.4.7-1.4mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64: b5083b87e10faef50207e0774dbd4d1c mes5/x86_64/gimp-2.4.7-1.4mdvmes5.2.x86_64.rpm efaa99214382712e2656780b06ef63a0 mes5/x86_64/gimp-python-2.4.7-1.4mdvmes5.2.x86_64.rpm 008a36ea72e6578a25afd25769893db1 mes5/x86_64/lib64gimp2.0_0-2.4.7-1.4mdvmes5.2.x86_64.rpm b30995cb00d18e05a7e4221d0918af15 mes5/x86_64/lib64gimp2.0-devel-2.4.7-1.4mdvmes5.2.x86_64.rpm 2bc33101108e4bcddd0ccdf6a927958d mes5/SRPMS/gimp-2.4.7-1.4mdvmes5.2.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Debian Security Advisory DSA-2426-1 security@debian.org http://www.debian.org/security/ Florian Weimer March 06, 2012 http://www.debian.org/security/faq
Package : gimp Vulnerability : several Problem type : local Debian-specific: no CVE ID : CVE-2010-4540 CVE-2010-4541 CVE-2010-4542 CVE-2010-4543 CVE-2011-1782 CVE-2011-2896
Several vulnerabilities have been identified in GIMP, the GNU Image Manipulation Program.
CVE-2011-1782 The correction for CVE-2010-4543 was incomplete.
For the stable distribution (squeeze), these problems have been fixed in version 2.6.10-1+squeeze3.
For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 2.6.11-5.
We recommend that you upgrade your gimp packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJPVlM6AAoJEL97/wQC1SS+gDYH/j24PZB+ZC0nPXZUnc1y++I0 Kfvm2cCSKA1jK1g5OhWEKWkOlGn3W8blytT2gXtdYxLu3ySbb2SdTU8mKSoKcFjU rLuYFoyegORbtPf7vujCz8xy7LYNUUqSnJ9X0DSH2m1EcuvcSMunr5X0W2wxPMUS 5BqcKpBa1qN3NexAzEtnFmaSbjsC4C2w8L1YC+V4fNKTi5LDgYcsUthduv01v/LI zHGgPYdM7p5EJ+kzeWNsjJ9Y98R7QEtsIuGMRHGtjTzQiPVgkxEWlfuE8K0hxutu 812kVi1Ae1Ra/EtWxcNO136RCQonm7NY14Yk1iEzPuf6VUe+yn6jUCbUunZN6wc= =fKIu -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201209-23
http://security.gentoo.org/
Severity: Normal Title: GIMP: Multiple vulnerabilities Date: September 28, 2012 Bugs: #293127, #350915, #372975, #379289, #418425, #432582 ID: 201209-23
Synopsis
Multiple vulnerabilities have been found in GIMP, the worst of which allow execution of arbitrary code or Denial of Service.
Background
GIMP is the GNU Image Manipulation Program.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-gfx/gimp < 2.6.12-r2 >= 2.6.12-r2
Description
Multiple vulnerabilities have been discovered in GIMP. Please review the CVE identifiers referenced below for details.
Workaround
There is no known workaround at this time.
Resolution
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.6.12-r2"
References
[ 1 ] CVE-2009-1570 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1570 [ 2 ] CVE-2009-3909 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3909 [ 3 ] CVE-2010-4540 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4540 [ 4 ] CVE-2010-4541 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4541 [ 5 ] CVE-2010-4542 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4542 [ 6 ] CVE-2010-4543 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4543 [ 7 ] CVE-2011-1178 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1178 [ 8 ] CVE-2011-2896 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2896 [ 9 ] CVE-2012-2763 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2763 [ 10 ] CVE-2012-3402 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3402
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-23.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-1207-1 September 14, 2011
cups, cupsys vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
An attacker could send crafted print jobs to CUPS and cause it to crash or run programs.
Software Description: - cups: Common UNIX Printing System(tm) - server - cupsys: Common UNIX Printing System(tm) - server
Details:
Tomas Hoger discovered that the CUPS image library incorrectly handled LZW streams.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 11.04: libcupsimage2 1.4.6-5ubuntu1.4
Ubuntu 10.10: libcupsimage2 1.4.4-6ubuntu2.4
Ubuntu 10.04 LTS: libcupsimage2 1.4.3-1ubuntu1.5
Ubuntu 8.04 LTS: libcupsimage2 1.3.7-1ubuntu3.13
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-1207-1 CVE-2011-2896, CVE-2011-3170
Package Information: https://launchpad.net/ubuntu/+source/cups/1.4.6-5ubuntu1.4 https://launchpad.net/ubuntu/+source/cups/1.4.4-6ubuntu2.4 https://launchpad.net/ubuntu/+source/cups/1.4.3-1ubuntu1.5 https://launchpad.net/ubuntu/+source/cupsys/1.3.7-1ubuntu3.13
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201108-0236",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "swi-prolog",
"scope": "lte",
"trust": 1.8,
"vendor": "swi prolog",
"version": "5.10.4"
},
{
"model": "cups",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "1.4.6"
},
{
"model": "gimp",
"scope": "lte",
"trust": 1.0,
"vendor": "gimp",
"version": "2.6.11"
},
{
"model": "gimp",
"scope": "lte",
"trust": 0.8,
"vendor": "the gimp team",
"version": "2.6.11"
},
{
"model": "cups",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "1.4.7"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.7"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.2"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.5"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.11"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.4"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.10"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.8"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.3"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.6"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.6,
"vendor": "gnu",
"version": "2.6.9"
},
{
"model": "swi-prolog",
"scope": "eq",
"trust": 0.3,
"vendor": "swi prolog",
"version": "5.10"
},
{
"model": "enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "proactive contact",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.0"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6.2"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "5"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1.1"
},
{
"model": "enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "aura system manager",
"scope": "ne",
"trust": 0.3,
"vendor": "avaya",
"version": "6.3"
},
{
"model": "swi-prolog",
"scope": "eq",
"trust": 0.3,
"vendor": "swi prolog",
"version": "5.10.1"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.2"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.6.11"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.14"
},
{
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "linux lts amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.4"
},
{
"model": "linux lts powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "enterprise linux desktop client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "1.2.5"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.3.9"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.11"
},
{
"model": "enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "solaris express",
"scope": "eq",
"trust": 0.3,
"vendor": "sun",
"version": "11"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.3"
},
{
"model": "linux lts sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "linux lts i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2.3"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.8"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.15"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "ip deskphone",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "96x16"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.3.10"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.4.6"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.2"
},
{
"model": "freeflow print server 73.b3.61",
"scope": null,
"trust": 0.3,
"vendor": "xerox",
"version": null
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "oracle",
"version": "6"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.6.6"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.6.7"
},
{
"model": "enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "aura communication manager utility services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.3.14"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.6"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.16"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2011"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "linux lts lpia",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "8.04"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "aura presence services",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.12"
},
{
"model": "ir",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "4.0"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "aura system manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.2"
},
{
"model": "aura system manager sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "aura experience portal",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.0"
},
{
"model": "communication server 1000e signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "6.0"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "swi-prolog",
"scope": "ne",
"trust": 0.3,
"vendor": "swi prolog",
"version": "5.10.2"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "gimp",
"scope": "eq",
"trust": 0.3,
"vendor": "gimp",
"version": "2.2.17"
},
{
"model": "iq",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "5.1"
},
{
"model": "aura system manager",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1.1"
},
{
"model": "aura system manager sp2",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "6.1"
},
{
"model": "communication server 1000m signaling server",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "6"
},
{
"model": "communication server 1000e",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.5"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "freeflow print server 73.c0.41",
"scope": null,
"trust": 0.3,
"vendor": "xerox",
"version": null
},
{
"model": "communication server 1000m",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "7.0"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
}
],
"sources": [
{
"db": "BID",
"id": "49148"
},
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:swi-prolog:swi-prolog",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:the_gimp_team:gimp",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:cups",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat Security Response Team",
"sources": [
{
"db": "BID",
"id": "49148"
}
],
"trust": 0.3
},
"cve": "CVE-2011-2896",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "CVE-2011-2896",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "VHN-50841",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:H/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2011-2896",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2011-2896",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201108-279",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-50841",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-50841"
},
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895. The problem is CVE-2006-1168 and CVE-2011-2895 May be related toA third party could be put into an infinite loop and execute arbitrary code through a crafted compressed stream. GIMP is prone to a buffer-overflow vulnerability\nSuccessfully exploiting this issue may allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. The software enables a variety of image manipulations, including photo retouching, image compositing, and image creation. Gimp\u0027s \"LZWReadByte()\" function (plug-ins/common/file-gif-load.c) has a buffer overflow vulnerability when processing GIF graphics. \n \n The updated packages have been patched to correct these issues. \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2896\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Linux 2010.1:\n 6765f41707b43b717ddb8dd3bfa4cdbc 2010.1/i586/gimp-2.6.8-3.2mdv2010.2.i586.rpm\n 4c1aab6b423ab88f2fa0bb507a7c60bf 2010.1/i586/gimp-python-2.6.8-3.2mdv2010.2.i586.rpm\n 7fd3284b7bc8696ae8075f1a7349c732 2010.1/i586/libgimp2.0_0-2.6.8-3.2mdv2010.2.i586.rpm\n a61333781b8723af9f45dbb94ce9bbb9 2010.1/i586/libgimp2.0-devel-2.6.8-3.2mdv2010.2.i586.rpm \n f4a4c0635712389d3a438818c3bbde7c 2010.1/SRPMS/gimp-2.6.8-3.2mdv2010.2.src.rpm\n\n Mandriva Linux 2010.1/X86_64:\n d2ed9cb97e27c8ae7a718b904d442cd1 2010.1/x86_64/gimp-2.6.8-3.2mdv2010.2.x86_64.rpm\n a60fb4df9340ce11a17f8b3c0011c2ac 2010.1/x86_64/gimp-python-2.6.8-3.2mdv2010.2.x86_64.rpm\n 55a40dfc4c289c48a0971c4fbb01d395 2010.1/x86_64/lib64gimp2.0_0-2.6.8-3.2mdv2010.2.x86_64.rpm\n dd6d1abb065aa27644b369061f666b0c 2010.1/x86_64/lib64gimp2.0-devel-2.6.8-3.2mdv2010.2.x86_64.rpm \n f4a4c0635712389d3a438818c3bbde7c 2010.1/SRPMS/gimp-2.6.8-3.2mdv2010.2.src.rpm\n\n Mandriva Linux 2011:\n 40025c9fcafb3d02bd37c92b940c353d 2011/i586/gimp-2.6.11-7.1-mdv2011.0.i586.rpm\n 5a3226c6ecdbbae83b90ed9e28c6941a 2011/i586/gimp-python-2.6.11-7.1-mdv2011.0.i586.rpm\n 9f156b65a74d0b74538f50b441cc37c4 2011/i586/libgimp2.0_0-2.6.11-7.1-mdv2011.0.i586.rpm\n af0d3a7478773243aa76d99f148b5186 2011/i586/libgimp2.0-devel-2.6.11-7.1-mdv2011.0.i586.rpm \n 4b4024953d52232e1cf0f308dc3a16dc 2011/SRPMS/gimp-2.6.11-7.1.src.rpm\n\n Mandriva Linux 2011/X86_64:\n f8f0140aebd1666c5d10b09f57de20cc 2011/x86_64/gimp-2.6.11-7.1-mdv2011.0.x86_64.rpm\n d27e9d2ef098ad86d3f68adf1c5f49ca 2011/x86_64/gimp-python-2.6.11-7.1-mdv2011.0.x86_64.rpm\n da1fa7693e5cd7dd8d9807912a61161a 2011/x86_64/lib64gimp2.0_0-2.6.11-7.1-mdv2011.0.x86_64.rpm\n 453e8a82d6e7425a7a5e2758a5e6879d 2011/x86_64/lib64gimp2.0-devel-2.6.11-7.1-mdv2011.0.x86_64.rpm \n 4b4024953d52232e1cf0f308dc3a16dc 2011/SRPMS/gimp-2.6.11-7.1.src.rpm\n\n Mandriva Enterprise Server 5:\n 5ca4859d1aab6879d30e6b2188f38d4a mes5/i586/gimp-2.4.7-1.4mdvmes5.2.i586.rpm\n b6baebc7a47430b09816c43fee81370f mes5/i586/gimp-python-2.4.7-1.4mdvmes5.2.i586.rpm\n b22ac83c1f8d96d5919aaabe1af9aada mes5/i586/libgimp2.0_0-2.4.7-1.4mdvmes5.2.i586.rpm\n 73b245e8d872bfabaa20787c454e175b mes5/i586/libgimp2.0-devel-2.4.7-1.4mdvmes5.2.i586.rpm \n 2bc33101108e4bcddd0ccdf6a927958d mes5/SRPMS/gimp-2.4.7-1.4mdvmes5.2.src.rpm\n\n Mandriva Enterprise Server 5/X86_64:\n b5083b87e10faef50207e0774dbd4d1c mes5/x86_64/gimp-2.4.7-1.4mdvmes5.2.x86_64.rpm\n efaa99214382712e2656780b06ef63a0 mes5/x86_64/gimp-python-2.4.7-1.4mdvmes5.2.x86_64.rpm\n 008a36ea72e6578a25afd25769893db1 mes5/x86_64/lib64gimp2.0_0-2.4.7-1.4mdvmes5.2.x86_64.rpm\n b30995cb00d18e05a7e4221d0918af15 mes5/x86_64/lib64gimp2.0-devel-2.4.7-1.4mdvmes5.2.x86_64.rpm \n 2bc33101108e4bcddd0ccdf6a927958d mes5/SRPMS/gimp-2.4.7-1.4mdvmes5.2.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2426-1 security@debian.org\nhttp://www.debian.org/security/ Florian Weimer\nMarch 06, 2012 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : gimp\nVulnerability : several\nProblem type : local\nDebian-specific: no\nCVE ID : CVE-2010-4540 CVE-2010-4541 CVE-2010-4542 CVE-2010-4543\n CVE-2011-1782 CVE-2011-2896\n\nSeveral vulnerabilities have been identified in GIMP, the GNU Image\nManipulation Program. \n\nCVE-2011-1782\n\tThe correction for CVE-2010-4543 was incomplete. \n\n\nFor the stable distribution (squeeze), these problems have been fixed in\nversion 2.6.10-1+squeeze3. \n\nFor the testing distribution (wheezy) and the unstable distribution\n(sid), these problems have been fixed in version 2.6.11-5. \n\nWe recommend that you upgrade your gimp packages. \n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.10 (GNU/Linux)\n\niQEcBAEBAgAGBQJPVlM6AAoJEL97/wQC1SS+gDYH/j24PZB+ZC0nPXZUnc1y++I0\nKfvm2cCSKA1jK1g5OhWEKWkOlGn3W8blytT2gXtdYxLu3ySbb2SdTU8mKSoKcFjU\nrLuYFoyegORbtPf7vujCz8xy7LYNUUqSnJ9X0DSH2m1EcuvcSMunr5X0W2wxPMUS\n5BqcKpBa1qN3NexAzEtnFmaSbjsC4C2w8L1YC+V4fNKTi5LDgYcsUthduv01v/LI\nzHGgPYdM7p5EJ+kzeWNsjJ9Y98R7QEtsIuGMRHGtjTzQiPVgkxEWlfuE8K0hxutu\n812kVi1Ae1Ra/EtWxcNO136RCQonm7NY14Yk1iEzPuf6VUe+yn6jUCbUunZN6wc=\n=fKIu\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201209-23\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: GIMP: Multiple vulnerabilities\n Date: September 28, 2012\n Bugs: #293127, #350915, #372975, #379289, #418425, #432582\n ID: 201209-23\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in GIMP, the worst of which\nallow execution of arbitrary code or Denial of Service. \n\nBackground\n==========\n\nGIMP is the GNU Image Manipulation Program. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 media-gfx/gimp \u003c 2.6.12-r2 \u003e= 2.6.12-r2\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in GIMP. Please review\nthe CVE identifiers referenced below for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll GIMP users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=media-gfx/gimp-2.6.12-r2\"\n\nReferences\n==========\n\n[ 1 ] CVE-2009-1570\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1570\n[ 2 ] CVE-2009-3909\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3909\n[ 3 ] CVE-2010-4540\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4540\n[ 4 ] CVE-2010-4541\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4541\n[ 5 ] CVE-2010-4542\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4542\n[ 6 ] CVE-2010-4543\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4543\n[ 7 ] CVE-2011-1178\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1178\n[ 8 ] CVE-2011-2896\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2896\n[ 9 ] CVE-2012-2763\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2763\n[ 10 ] CVE-2012-3402\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3402\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201209-23.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2012 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n. ==========================================================================\nUbuntu Security Notice USN-1207-1\nSeptember 14, 2011\n\ncups, cupsys vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 11.04\n- Ubuntu 10.10\n- Ubuntu 10.04 LTS\n- Ubuntu 8.04 LTS\n\nSummary:\n\nAn attacker could send crafted print jobs to CUPS and cause it to crash or\nrun programs. \n\nSoftware Description:\n- cups: Common UNIX Printing System(tm) - server\n- cupsys: Common UNIX Printing System(tm) - server\n\nDetails:\n\nTomas Hoger discovered that the CUPS image library incorrectly handled LZW\nstreams. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 11.04:\n libcupsimage2 1.4.6-5ubuntu1.4\n\nUbuntu 10.10:\n libcupsimage2 1.4.4-6ubuntu2.4\n\nUbuntu 10.04 LTS:\n libcupsimage2 1.4.3-1ubuntu1.5\n\nUbuntu 8.04 LTS:\n libcupsimage2 1.3.7-1ubuntu3.13\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n http://www.ubuntu.com/usn/usn-1207-1\n CVE-2011-2896, CVE-2011-3170\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/cups/1.4.6-5ubuntu1.4\n https://launchpad.net/ubuntu/+source/cups/1.4.4-6ubuntu2.4\n https://launchpad.net/ubuntu/+source/cups/1.4.3-1ubuntu1.5\n https://launchpad.net/ubuntu/+source/cupsys/1.3.7-1ubuntu3.13\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-2896"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"db": "BID",
"id": "49148"
},
{
"db": "VULHUB",
"id": "VHN-50841"
},
{
"db": "PACKETSTORM",
"id": "106598"
},
{
"db": "PACKETSTORM",
"id": "107429"
},
{
"db": "PACKETSTORM",
"id": "105296"
},
{
"db": "PACKETSTORM",
"id": "110489"
},
{
"db": "PACKETSTORM",
"id": "116983"
},
{
"db": "PACKETSTORM",
"id": "105118"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-2896",
"trust": 3.4
},
{
"db": "BID",
"id": "49148",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "46024",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "45945",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "45621",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "45948",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "50737",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "48236",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "48308",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "45900",
"trust": 1.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2011/08/10/10",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1025929",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201108-279",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "107429",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "105118",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "105296",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "107564",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "110007",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "115681",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-50841",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "106598",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "110489",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116983",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-50841"
},
{
"db": "BID",
"id": "49148"
},
{
"db": "PACKETSTORM",
"id": "106598"
},
{
"db": "PACKETSTORM",
"id": "107429"
},
{
"db": "PACKETSTORM",
"id": "105296"
},
{
"db": "PACKETSTORM",
"id": "110489"
},
{
"db": "PACKETSTORM",
"id": "116983"
},
{
"db": "PACKETSTORM",
"id": "105118"
},
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"id": "VAR-201108-0236",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-50841"
}
],
"trust": 0.01
},
"last_update_date": "2026-03-09T21:41:51.635000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Apple Open Source",
"trust": 0.8,
"url": "http://www.apple.com/opensource/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.gimp.org/"
},
{
"title": "Bug 7",
"trust": 0.8,
"url": "http://www.swi-prolog.org/bugzilla/show_bug.cgi?id=7#c4"
},
{
"title": "GNU Gimp \u0027LZWReadByte()\u0027 GIF Fixes for Graphics Parsing Buffer Error Vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=180847"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "CWE-119",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-50841"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://git.gnome.org/browse/gimp/commit/?id=376ad788c1a1c31d40f18494889c383f6909ebfc"
},
{
"trust": 2.0,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=730338"
},
{
"trust": 1.8,
"url": "http://security.gentoo.org/glsa/glsa-201209-23.xml"
},
{
"trust": 1.8,
"url": "http://www.ubuntu.com/usn/usn-1207-1"
},
{
"trust": 1.8,
"url": "http://www.ubuntu.com/usn/usn-1214-1"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1025929"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/45621"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/45900"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/45945"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/45948"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/46024"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/48236"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/48308"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/49148"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/50737"
},
{
"trust": 1.7,
"url": "http://www.debian.org/security/2011/dsa-2354"
},
{
"trust": 1.7,
"url": "http://www.debian.org/security/2012/dsa-2426"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-august/064873.html"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-august/064600.html"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-september/065550.html"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-september/065651.html"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-september/065527.html"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-september/065539.html"
},
{
"trust": 1.7,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:146"
},
{
"trust": 1.7,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:167"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2011-1635.html"
},
{
"trust": 1.7,
"url": "http://rhn.redhat.com/errata/rhsa-2012-1180.html"
},
{
"trust": 1.7,
"url": "http://rhn.redhat.com/errata/rhsa-2012-1181.html"
},
{
"trust": 1.7,
"url": "http://www.openwall.com/lists/oss-security/2011/08/10/10"
},
{
"trust": 1.7,
"url": "http://cups.org/str.php?l3867"
},
{
"trust": 1.7,
"url": "http://www.swi-prolog.org/bugzilla/show_bug.cgi?id=7#c4"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=727800"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2896"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2896"
},
{
"trust": 0.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2896"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100154006"
},
{
"trust": 0.3,
"url": "http://downloads.avaya.com/css/p8/documents/100160772"
},
{
"trust": 0.3,
"url": "http://blogs.oracle.com/sunsecurity/entry/cve_2011_2896_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://www.gimp.org/"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100151369"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100153926"
},
{
"trust": 0.3,
"url": "https://downloads.avaya.com/css/p8/documents/100165732"
},
{
"trust": 0.3,
"url": "http://www.xerox.com/download/security/security-bulletin/1284333-14afb-4baadb5bccb00/cert_xrx12-002_v1.1.pdf"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3170"
},
{
"trust": 0.2,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.2,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4542"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4540"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4541"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4543"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2895"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2006-1168"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/gimp/2.6.10-1ubuntu3.4"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/gimp/2.6.8-2ubuntu1.4"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/gimp/2.6.11-1ubuntu6.2"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1782"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-2763"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2763"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2012-3402"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4540"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1178"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-1570"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-3402"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2009-3909"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4541"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4542"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-2896"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4543"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1178"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-3909"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-1570"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/cups/1.4.3-1ubuntu1.5"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/cupsys/1.3.7-1ubuntu3.13"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/cups/1.4.6-5ubuntu1.4"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/cups/1.4.4-6ubuntu2.4"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-50841"
},
{
"db": "BID",
"id": "49148"
},
{
"db": "PACKETSTORM",
"id": "106598"
},
{
"db": "PACKETSTORM",
"id": "107429"
},
{
"db": "PACKETSTORM",
"id": "105296"
},
{
"db": "PACKETSTORM",
"id": "110489"
},
{
"db": "PACKETSTORM",
"id": "116983"
},
{
"db": "PACKETSTORM",
"id": "105118"
},
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-50841"
},
{
"db": "BID",
"id": "49148"
},
{
"db": "PACKETSTORM",
"id": "106598"
},
{
"db": "PACKETSTORM",
"id": "107429"
},
{
"db": "PACKETSTORM",
"id": "105296"
},
{
"db": "PACKETSTORM",
"id": "110489"
},
{
"db": "PACKETSTORM",
"id": "116983"
},
{
"db": "PACKETSTORM",
"id": "105118"
},
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-08-19T00:00:00",
"db": "VULHUB",
"id": "VHN-50841"
},
{
"date": "2011-08-15T00:00:00",
"db": "BID",
"id": "49148"
},
{
"date": "2011-11-04T21:06:51",
"db": "PACKETSTORM",
"id": "106598"
},
{
"date": "2011-12-01T00:06:52",
"db": "PACKETSTORM",
"id": "107429"
},
{
"date": "2011-09-22T15:56:42",
"db": "PACKETSTORM",
"id": "105296"
},
{
"date": "2012-03-06T23:59:02",
"db": "PACKETSTORM",
"id": "110489"
},
{
"date": "2012-09-28T23:51:10",
"db": "PACKETSTORM",
"id": "116983"
},
{
"date": "2011-09-14T22:51:57",
"db": "PACKETSTORM",
"id": "105118"
},
{
"date": "2011-08-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"date": "2011-08-19T17:55:03.317000",
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-30T00:00:00",
"db": "VULHUB",
"id": "VHN-50841"
},
{
"date": "2015-04-13T21:59:00",
"db": "BID",
"id": "49148"
},
{
"date": "2022-02-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201108-279"
},
{
"date": "2012-03-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-004828"
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2011-2896"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "106598"
},
{
"db": "PACKETSTORM",
"id": "105118"
},
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CUPS Used in products such as LZW Infinite loop vulnerability in decompressor",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-004828"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201108-279"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…